4 ms·
Is the flash message setup a standard way implement that type of functionality?? Encrypting the cookie with a key that is delivered client side anyway seems lik
by positr0n 10y ago
Is the flash message setup a standard way implement that type of functionality?? Encrypting the cookie with a key that is delivered client side anyway seems like it doesn't buy you anything.
- kevinburke 10y agoThe key isn't sent to the client. You can set the flash message in plain text, but I'd rather avoid the possibility of tampering, and it lets me reuse the same cookie code I use to encrypt e.g. session tokens.
- deleted 10y ago[deleted]
- slrz 10y agoWhat kind of tampering are you thinking about here? Aren't those messages sent from the server to the client? Thus, in-transit tampering should be prevented by TLS. If the key isn't sent to the client, how is the client supposed to display that message? Why are these messages encoded into a cookie in the first place? I don't think I understand the concept.
- kevinburke 10y agoThe message is read on the server as part of the next request and then displayed in the appropriate spot in thr UI
- hasenj 10y agoThis kind of scheme is used by flask. If you have access to the cookies you can decrypt and read then but you can't change any of the content.